Details of the investigation into the COVID-19 active cases privacy breach have been revealed, and it's expected to be completed by the end of July.
It was revealed last week there'd been a leak and the names, ages, addresses and more personal details of New Zealand's active cases were sent to three media outlets.
An investigation was launched at the weekend, and the State Services Commission will conduct the inquiry. Michael Heron QC will lead the investigation.
State Services Minister Chris Hipkins says Heron can require documents to be produced, summon witnesses and question people under oath.
"The investigation will look at who or what caused the disclosure of the information, identifying what, if anything, might've prevented this from happening, and what, if any, improvements might prevent this from happening again in the future," he said on Monday.
"My message to all involved is simple and clear: New Zealanders have an absolute right to expect that their personal information will be held and handled in the strictest of confidence. The public release of this information is wrong."
People who have access to the breached information include people who manage isolation facilities, relevant public health officials and those involved in testing, Hipkins says.
He's unsure exactly how the breach occurred or whether the data was released in hard or electronic copy, and says that's why there's an investigation.
"I'm determined to find out why it happened, how it happened and ensure systems are put in place to prevent it happening again in the future."
He says officials have already looked at everyone who has access to this information, all the ways the data was stored and any immediate steps that can be taken to better protect it.
"Obviously I'm going to be working very closely with them over the coming week or so to make sure that things are as robust as they can be. But that's why this investigation is being done urgently, because if there are further measures that need to be put in place we want to identify those as quickly as we can."
State Services Commissioner Peter Hughes confirmed Hipkins had asked him to undertake the investigation, and he also reiterated how the inquiry may prevent a similar situation from happening again.
"This is sensitive personal information that should not be in the public arena," he says.
